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TAMPER-RESISTANT  TELEVISION  SUR^fEILLANCE  SYSTEM 


1.  INTRODUCTION 

The  problem  of  the  design  of  a  tamper-reslstant/tamper- 
Indlcating  television  surveillance  system  has  been  of  concern  to 
the  U.S.  Arms  Control  and  Disarmament  Agency  for  a  number  of 
years  because  of  the  role  such  a  system  might  play  in  the  process 
of  implementing  and  verifying  certain  international  arms  control 
or  safeguards  agreements.     The  impetus  to  this  cause  is  stated 
in  the  preamble  to  -the  Treaty  on  the  Non-Proliferation  of  Nuclear 
Weapons.     It  expresses  on  the  part  of  the  States  concluding  the 
Treaty,  "their  support  for  research,  development  and  other  efforts 
to  further  the  application,  within  the  framework  of  the  Inter- 
national Atomic  Energy  Agency  (IAEA)  safeguards  system,  of  the 
principle  of  safeguarding  effectively  the  flow  of  source  and 
special  fissionable  materials  by  use  of  instruments  and  other 
techniques  at  certain  strategic  points." 

In  the  summer  of  1968  it  became  apparent  to  authorities 
involved  in  safeguards  in  the  United  States  of  America  and 
Canada  that  a  cooperative  safeguards  development  program  might 
be  of  mutual  benefit  to  the  two  governments  and  also  support 
the  principles  of  the  Non-Proliferation  Treaty  (NPT)  and  assist 
the  IAEA  in  carrying  out  its  increased  responsibilities  under 
the  NPT.     After  several  general  discussions  between  officials 
of  both  governments  had  confirmed  a  mutual  interest,  the  two 
parties  agreed  to  Join  in  an  effort  to  design,  build,  install, 
and  test  on  a  CANDU-type  power  generating  reactor,  the  prototype 
of  an  unattended  tamper-resistant/tamper-indicating  safeguards 
instrumentation  system.     The  cooperating  agencies  in  the  two 
Governments  are  the  United  States  Atomic  Energy  Commission,  (now 
Energy  Research  and  Development  Agency)  the  United  States  Arms 
Control  and  Disarmament  Agency,  Atomic  Energy  of  Canada  Limited, 
and  the  Atomic  Energy  Control  Board  of  Canada. 

Since  then,  a  joint  US/Canadian  Working  Group  composed  of 
members  of  the  contributing  agencies  and  contractors  has  developed 
the  overall  features  desired  for  the  instrumentation  system.  The 
program  has  two  objectives: 

1)  To  develop  and  evaluate  prototype  instrumentation 
(unattended  and  secure)  which  may  be  applicable 

to  the  safeguarding  of  nuclear  material  in  reactors 
and  other  nuclear  facilities. 

2)  To  test  tamper-resistant/tamper-indicating  techniques 
and  devices  in  the  severe  environment  of  an  operating 
power  reactor. 

This  report  describes  a  tamper-resistant  television  sur- 
veillance system  designed  to  provide  over  long  unattended 
intervals  high  quality  pictures  which  can  be  conveniently  and 
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accurately  interpreted  by  an  inspector.     It  is  intended  to  com- 
plement the  safeguards    instrumentation  system  presently  under 
test  at  the  Nuclear  Power  Demonstration  (NPD)  reactor  near 
Rolphton,  Ontario,  Canada.     This  system  is  identified  by  the 
acronym,  TRUST,  meaning,  Tamper-Resistant  Unattended  Safeguards 
Techniques.     Such  a  system  would  complement  the  normal  activity 
of  inspectors.     Although  the  design  considerations  for  this  TV 
system  have  been  primarily  determined  by  the  surveillance  re- 
quirements at  NPD,  it  has  the  flexibility  to  be  used  in  many 
other  surveillance  applications  where  resistance  to  tampering 
is  required. 

2.     PRELIMINARY  CONSIDERATIONS 

Before  dealing  with  the  particular  design  aspects  of  the 
TV  surveillance  system  it  is  important  to  point  out  some  of  the 
decisions  and  guidelines  that  have  evolved  from  the  Working  Group, 
It  is  these  guidelines,  some  of  which  are  political  in  nature, 
that  have  influenced  the  particular  design  of  this  TV  system. 

One  important  guideline  laid  down  by  the  Working  Group  is 
that  the  system  must  be  so  designed  that  the  integrity  of  the 
safeguards  data  is  maintained,  although  all  design  and  opera- 
tional details  of  the  instruments  are  made  available  to  the 
reactor  facility  operator.     The  necessity  for  this  arises  from 
two  considerations.     It  is  assumed  that  the  design  details  of 
all  instrumentation  would  be  revealed  to  all  participating 
governments  and  that  the  system  must  be  acceptable  to  the 
operator.     The  operator  who  is  responsible  for  the  safe  and 
economic  operation  of  the  station  is  in  the  best  position  to 
determine  whether  a  particular  design  involves  no  risk  to  the 
station.     Hence,  design  secrecy  cannot  be  used  as  a  technique 
for  maintaining  measurement  integrity. 

It  appears  that  no  system  is  impenetrable.     Given  enough 
time,  money,  and  ingenuity,  any  system  can  be  defeated.  How- 
ever, the  major  purpose  can  still  be  achieved  if  the  system 
is  designed  such  that  the  cost  and  risk  of  fissionable  materials 
diversion  greatly  exceed  the  value  of  diversion    and  the 
system  indicates  unequivocally  that  it  has  been  tampered  with. 
Thus,  the  term  tamper-resistant/tamper-indicating  was  adopted. 
This  does  not  necessarily  simplify  the  design  efforts  of  a 
safeguards  instrumentation  system  but  provides  a  basis  whereby 
a  crude  figure  of  merit  or  cost  effectiveness  might  be 
established.     For  example  this  might  be  the  cost  of  diversion 
versus  the  cost  of  the  safeguards  system,  or  the  cost  of 
diversion  versus  the  value  of  a  diversion.     Care  must  be  exer- 
cised in  applying  such  a  measure  of  effectiveness  to  only  portions 
of  a  system  because  of  the  interdependence  of  the  subsystems. 
In  addition,  economics  in  some  instances  may  not  be  the  primary 
measurement  of  effectiveness. 
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Early  In  the  program  many  designs  of  tamper-resistant  sensors, 
containers,  and  seals  were  evaluated.     An  outstanding  problem  was 
maintaining  security  of  the  data  link  between  the  sensors  and  the 
recording  station.     Time  domain  reflectometry  techniques  were 
examined  as  a  means  of  securing  the  data  link  but  a  number  of 
practical  problems  limited  Its  general  application.    The  Working 
Group  reluctantly  adopted  the  technique  of  encoding  data  as  the 
most  practical  means  of  securing  data.     Although  this  may  seem 
to  violate  the  policy  of  not  disclosing  the  system  design,  the 
Important  distinction  Is  that  encoded  data  is  used  only  for  the 
purpose  of  checking  the  integrity  of  data  and  not  for  the  purpose 
of  withholding  design  or  measurement  information.     In  fact,  many 
portions  of  the  system  make  available  both  clear  data  as  well  as 
encoded  data. 

An  additional  problem  which  must  be  considered  for  any  un- 
attended system  is  that  it  is  vulnerable  to  harassment  by  an 
operator.     He  can  damage  the  equipment  "accidentally,"  cause 
component  failures  which  tend  to  discredit  the  system  in  the  eyes 
of  the  Inspector,  or  remove  Installed  safeguards  equipment  because 
of  an  "operational  emergency,"    Harassment  of  this  nature  is  one 
obvious  unavoidable  way  to  defeat  an  instrumentation  system,  A 
good  defense  against  subtle  types  of  sabotaging  is  to  employ  the 
simplest  design  possible  with  a  high  proven  reliability.  This 
permits  one  to  distinguish  between  true  failures  and  harassment. 
The  Working  Group  concluded  that  harassment  vras  a  manageable 
problem  as  long  as  the  inspection  agency  retained  the  capability 
of  replacing  the  unattended  system  with  inspectors  should  it 
become  clear  that  the  desired  effectiveness  and  reliability  were 
not  being  achieved  by  this  instrumentation. 

3.     DESIGN  OBJECTIVES 

Television  was  chosen  Instead  of  direct  film  photography 
because  of  its  adaptability  to  a  radiation  environment.  Long 
term,  low  level  radiation  will  not  obscure  the  records  nor  will 
a  plausible  accident  wipe  out  all  the  data.     In  addition,  TV 
conforms  to  the  generally  adopted  concept  of  remote  sensing 
devices  reporting  to  one  central  recording  station  in  a  facility. 

The  following  two  principal  design  objectives  for  a  TV 
Surveillance  system  were  established  by  the  Working  Group: 

1.  Unattended  operation  and  data  storage  capacity 
for  a  period  up  to  90  days. 

2.  Resistance  to  deception  by  video  substitution  on 
the  transmission  line  or  direct  scene  substitution 
In  the  TV  camera  field  of  view. 

There  are  essentially  two  different  approaches  one  can  take 
in  the  surveillance  of  an  area.     One  approach  is  to  record  data 
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very  frequently  regardless  of  what  is  taking  place  in  the  area. 
In  the  case  of  recording  pictures  the  total  number  can  easily  over- 
whelm any  reasonable  storage  capability  and  more  important,  can 
make  analysis  difficult  and  costly.     A  bank  camera  uses  this 
approach  by  taking  pictures  continuously  which  are  only  analyzed 
after  the  fact.     Seldom  do  all  the  pictures  have  to  be  analyzed 
since  the  time  a  robbery  occurred  is  usually  known.     On  the  other 
hand,  if  pictures  are  to  be  used  to  detect  whether  certain 
unauthorized  activity  has  occurred,  a  second  approach  is  often 
preferable.     The  technique  is  to  selectively  record  pictures 
of  the  scene  when  a  "change  occurs  and  limit  the  number  when  there 
is  no  change.     This  can  be  accomplished  by  employing  motion 
detectors  which  monitor  selected  areas  in  the  field  of  view 
and  record  a  picture  if  there  is  motion  at  any  one  of  these 
locations.     This  technique  can  also  partially  protect  against 
f ield-of-view  substitution.     Protection  against  tampering  on 
the  video  transmission  line  is  provided  by  encoding  the 
luminance  levels  of  the  output  video  signal.     It  is  these 
two  design  features  that  have  been  the  major  area  of  develop- 
ment for  this  system.     A  qualitative  description  of  the  system 
follows.     Explicit  operational  details  and  schematics  are  not 
included. 

4.     SYSTEM  DESCRIPTION 

Pig.  1  shows  a  block  diagram  of  the  tamper-resistant 
television  surveillance  system.     The  system  employs  a  commercial 
525  line,  high  resolution,  closed  circuit  TV  system  coupled 
with  a  16mm  movie  camera  adapted  for  single  frame  use.  Pictures 
are  photographed  directly  from  the  monitor  with  time  indicated 
on  each  frame  by  means  of  a  digital  clock  located  in  the  camera's 
field  of  view.     The  video  signal  from  the  TV  camera  is  encoded 
for  protection  against  substitution  of  false  video  information 
on  the  transmission  line  to  the  recording  station.     Encoded  video 
signals  are  instantaneously  decoded  in  the  recording  station  so 
that  a  continuous  clear  picture  is  present  at  all  times  on  the 
monitor.     Coding  security  is  insured  by  using  matching  sets  of 
random  words  stored  on  punched  tape  in  the  camera's  secure  container 
and  the  secure  recording  station.     Each  word  is  used  only  once 
for  one  recorded  picture.     After  a  picture  is  photographed  the 
tapes  are  advanced  in  synchronism  to  a  new  word  which  is  used  to 
change  the  encoding  pattern  at  the  instant  the  next  picture  is 
recorded. 

Motion  detectors,  utilizing  the  video  signal,  monitor 
selected  spots  in  the  TV  camera  field  of  view  and  command  the 
photographic  camera  to  record  a  picture  when  there  is  motion 
at  any  of  these  locations.     The  camera  can  also  be  commanded  by 
a  random-interval  timer. 

A  secure  container  houses  the  TV  camera,  encoder,  and  random 
word  tapes.  The  container  is  plastic,  silvered  on  the  inside  for 
security.     A  removable  end  cover  is  secured  to  the  container  by 
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a  fiber  optic  seal  [2,3]  threaded  through  holes  In  the  cover  and 
the  container.     The  recording  station  stores  all  the  data  for  the 
entire  safeguards  system.     This  area  consists  of  a  small  shielded 
room  secured  by  an  RF  intrusion  monitor  [^]. 

The  reasons  for  choosing  photographic  means  for  recording 
the  pictures  are  the  high  quality,  low  cost,  and  high  reliability 
inherent  with  photographic  techniques.     Photography  can  be  con- 
fidently employed  in  this  location  because  it  is  well  removed 
from  any  possible  source  of  radiation.     Furthermore,  photographic 
film  has  the  highest  information  packing  density  of  any  known 
storage  medium  and  pictures  stored  on  film  are  convenient  for 
direct  viewing  or  electronic  analysis.     Typically,  a  100- foot 
roll  of  16  mm  film  can  store  about  ^000  frames  which  can  be 
analyzed  by  use  of  a  special  projector.     The  projector  can 
operate  at  any  desired  frame  rate  without  flicker  and  stop  on 
any  frame  indefinitely  for  detailed  Inspection, 

Magnetic  tape  recorders  could  also  be  employed  for  the 
storage  of  pictures,  especially  for  short  unattended  Intervals 
and  situations  requiring  immediate  playback.     Some  surveillance 
situations  have  been  visualized  where  a  resident  Inspector  may 
want  to  review  pictures  of  perhaps  an  overnight  sequence.  If 
this  technique  were  used  to  record  single  frames,  provision 
would  have  to  be  made  to  reliably  operate  the  tape  recorder  in  ' 
a  start-stop  mode. 

The  elements  of  the  system  which  determine  the  quality  of 
pictures  on  film  are  the  TV  camera,  encoder,  decoder,  monitor, 
photographic  camera,  and  film.     The  primary  factors  which  affect 
the  overall  quality  of  a  picture  are  sharpness,  resolution  and 
gray  scale  rendition.     The  appearance  evaluation  of  a  picture 
image  in  terms  of  the  edge  characteristics  of  objects  is  called 
sharpness.     Sharpness  and  resolution  are  to  some  extent  inter- 
related but  do  not  always  perfectly  correlate.     Resolution  in 
a  television  system  is  expressed  in  terms  of  the  maximum  number 
of  lines  (black  and  white)  which  can  be  seen  in  a  distance 
across  the  face  of  the  monitor  tube  equal  to  the  raster  height. 
Vertical  resolution  in  a  well  adjusted  system  roughly  equals 
the  number  of  scanning  lines.     In  practice,  however,  a  standard 
525  line  system  produces  typical  vertical  resolution  values  of 
about  450  lines  because  some  of  the  lines  are  blanked  for 
frame  synchronization  purposes. 

Resolution  in  photography  is  usually  expressed  as  the 
maximum  number  of  lines  (counting  only  black  or  white  ones)  per 
millimeter  which  can  be  distinguished  from  one  another.     In  order 
to  relate  TV  vertical  resolution  in  terms  of  photographic 
resolution  the  height  of  the  frame  and  this  factor  of  2  must  be 
considered.     The  height  of  a  I6  mm  frame  is  about  8  mm.  Thus, 
a  450  TV  line  vertical  resolution  can  be  considered  equivalent 
to  a  photographic  resolution  of  about  28  (l,e,  450/(2x8))  lines  per 
millimetre.     However,  to  resolve  the  maximum  TV  vertical 
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resolution  on  film  a  photographic  resolution  (lens  &  film) 
of  greater  than  28  lines  per  mm  is  required.     This  is  because  the 
combination  of  both  systems  operating  at  the  same  limiting  resolu- 
tion produces  a  resultant  resolution  less  than  either.  Considering 
practical  16  mm  film  speeds  and  moderate  lens  qualities,  measure- 
ments using  standard  high  contrast  photographic  resolution  charts 
indicated  that  a  resolving  power  of  about  65  lines  per  millimetre 
(center)  and  50  lines  per  millimetre  (edges)  could  be  achieved. 
Evaluation  of  TV  resolution  chart  images  on  film  obtained  through 
the  entire  system  (i.e.  TV  camera,  monitor  photographic  camera) 
indicated  that  the  above  resolution  is  sufficient  to  resolve  the 
maximum  vertical  TV  resolution.     In  fact,  under  these  conditions 
it  is  possible  to  distinguish  the  raster  scanning  lines  in  an 
ordinary  picture. 

In  order  to  obtain  the  full  vertical  resolution  of  a  TV  picture 
on  film  the  2:1  interlace  system  must  be  used.     Random  interlace 
will  produce  only  about  one  half  of  the  typical  vertical 
resolution  of  a  525  line  system  on  film. 1 

Horizontal  resolution  of  a  TV  system  is  determined  entirely 
by  the  bandwith  of  the  system.     The  TV  camera  chosen  for  this 
application  has  a  specified  resolution  of  900  lines  (center)  and 
600  lines  (edges)  which  somewhat  exceeds  the  practical  resolution 
limits  of  the  photographic  portion  of  the  system.     Hence,  vertical 
resolution  is  TV-limited  and  horizontal  resolution  is  photograph- 
ically limited. 

The  gray  scale  rendition  of  the  system  is  primarily  limited 
by  the  encoding  system  which  quantizes  the  gray  scales  of  the 
output  video  signal.     The  gray  scale  of  a  properly  exposed  film 
usually  far  exceeds  the  gray  scale  resolution  of  typical  closed 
circuit  TV  systems. 

An  important  feature  of  a  TV  camera  in  most  surveillance 
systems  is  the  ability  to  compensate  for  variations  in  scene 
illumination.     This  helps  to  maintain  a  reasonably  constant 
exposure,  but  more  important,  provides  a  constant  amplitude  video 
signal  which  limits  the  dynamic  range  of  the  encoder. 

Listed  below  is  a  summary  of  pertinent  performance  speci- 
fications of  the  TV  camera  and  monitor  employed  for  this  application. 


There  are  two  scanning  systems  commonly  employed  in  closed  circuit  TV  systems, 
random  interlace  and  2:1  interlace.     In  the  random  interlace  there  are  roughly 
262  lines  per  field  and  the  line  frequency  is  not  locked  to  the  frame  rate. 
This  produces  a  slight  random  movement  of  the  lines  for  each  field  which  the  eye 
integrates  giving  the  appearance  of  more  vertical  resolution.     In  a  2:1  inter- 
lace the  scanning  of  a  frame  is  divided  into  two  parts,  each  part  being  referred 
to  as  a  field.     In  the  odd  field  lines  are  scanned  in  the  order  1,3,5,7,  etc., 
until  half  the  lines  have  been  scanned.     Then  scanning  begins  again  at  line  2 
and  proceeds  in  the  order  2,4,6,  etc.,  until  the  entire  frame  has  been  scanned. 
The  effect  of  such  interleaving  is  to  reduce  the  flicker  to  the  point  where  It 
is  no  longer  perceptible  to  the  eye. 
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TV  Camera 


1.  Resolution-900  lines  center,  600  lines  in  corners, 
at  30  frames  per  second,  4:3  aspect  ratio 

2.  Automatic  Light  Range  5000:1,  video  remains  constant 
to  within  6  dB  for  a  change  in  vidicon  faceplate 
illumination  from  2.2  to  1080  lux  (0.2  to  100  foot- 
candles). 

3.  Gray-Scale  Rendition  -  resolves  all  ten  shades  of 
gray  on  EIA  TV  Resolution  Charts. 


TV  Monitor 

1.  Video  Response  -  10  MHz 

2.  Resolution  -  800  lines  center,  600  lines  in  corners 

3.  Linearity,  Horizontal  and  Vertical  -  2.%  of  picture  height 

4.1  Encoder 

Pig.  2  shows  a  simplified  block  diagram  of  the  encoder 
outlined  in  Pig.  1.     The  elements  consist  of  a  4  bit  analog 
to  digital  converter,  permuter,  and  line  drivers.     The  video 
output  signal  from  the  TV  camera  is  quantized  into  l6  levels 
coded  in  a  4  bit  binary  Gray  code.     Preliminary  investigation 
and  a  search  of  the  literature  has  shown  that  video  luminance 
levels  quantized  with  4  bit  resolution  produce  acceptable 
pictures  after  decoding  with  some  noticeable  contouring.  Con- 
touring caused  by  too  coarse  quantization  produces  pictures 
similar  to  those  painted  by  the  familiar  "paint  by  numbers" 
technique.     The  effect  is  more  noticeable  in  some  pictures 
because  the  eye  requires  rather  accurate  values  of  luminance 
in  large  regions  of  gradually  changing  gray  scale  such  as  a 
close-up  view  of  a  person *s  face  where  shadowing  is  important 
to  the  overall  composition.     Pictures  which  contain  many 
small  details  are  more  tolerant  of  gray  scale  quantization, 

A  horizontal  resolution  of  900  TV  lines  requires  a  band- 
width of  about  10  MHz.     The  analog  to  digital  (a/d)  converter 
must  be  able  to  make  conversions  at  this  rate.     A  multi- 
threshold  4  bit  converter,  by  far  the  fastest  and  most  straight- 
forward of  all  a/d  converters,  was  designed  for  this  application. 
It  requires  only  15  comparators,  operates  almost  instan- 
taneously, and  is  limited  only  by  the  delays  of  one  comparator 
and  a  few  logic  gates.     Transient  errors  and  circuits  required 
to  suppress  them  are  eliminated  by  converting  to  a  Gray  code 
rather  than  the  natural  binary  code.     A  Gray  code  converter 
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offers  higher  accuracy  and  higher  speed  because  each  code  differs 
from  the  adjacent  numbers  in  only  one  bit  position.  Hence, 
the  transitional  errors  of  the  video  signal  are  reduced  to  one 
bit  which  results  in  minimal  picture  noise. 

The  contouring  effect  from  the  ^  bit  quantization  is 
further  reduced  by  a  simple  technique  which  tends  to  smooth  out 
intensity  transitions  to  levels  approaching  5  bit  quantization. 
This  is  done  by  not  providing  hysteresis  in  the  comparators  of 
the  a/d.     This  causes  an  individual  comparator  to  oscillate 
when  the  signals  approach  the  threshold  levels.     For  instance, 
if  the  level  of  a  video  signal  is  at  the  threshold  value  of 
comparator  number  8  the  comparator  will  oscillate,  resulting 
in  encoded  levels  oscillating  between  values  of  7  and  8.  The 
frequency  is  high  enough  to  produce  a  fine  grained  intensity 
structure  which  to  the  eye  or  film  appears  as  the  average 
between  the  two  levels.     The  result  is  a  much  more  pleasing 
picture  than  that  produced  by  pure  4  bit  quantization. 

The  permuter  of  Fig.  2  permutes  and  inverts  some  of  the 
bits  before  they  are  transmitted  to  the  recording  station  via 
the  line  drivers.     The  purpose  of  scrambling  the  digital 
information  is  to  make  it  difficult  to  decode  the  information 
in  a  sufficiently  short  time  to  substitute  a  false  video  signal 
with  the  correct  coding  on  the  line.     The  maximum  number  of 
permutations  for  the  4  bits  is  4  factorial.     Thus,  to  effect 
the  24  possible  combinations,  a  minimum  of  5  binary  control  bits 
are  required.     Fig.   3  shows  in  block  form  the  scheme  used  that 
provides  19  out  of  the  24  possible  permutations.     Each  box 
represents  a  double-pole  double-throw  (dpdt)  switch  connected 
as  a  reversing  switch.     When  the  control  for  a  switch  is  in 
state  0  the  input-output  data  lines  are  uncrossed  and  when  in 
state  1  they  are  crossed.     Each  dpdt  switch  is  implemented  with 
standard  logic  gates.     The  advantage  of  this  configuration  is  that 
the  maximum  difference  in  signal  propagation  delay  between  any  line 
is  that  of  one  dpdt  switch  which  typically  may  be  10  nanoseconds. 
This  amount  of  delay  is  far  less  than  one  picture  element  of  the 
highest  resolution  picture  being  considered.     Although  this  line 
permuter  does  not  quite  provide  the  maximum  number  of  permutations 
it  is  simple;  it  also  provides  a  random  inversion  of  some  bits 
because  each  dpdt  switch  inverts  the  data.     Bits  which  go  through 
an  even  number  are  not  inverted,  regardless  of  which  state  the 
switches  are  in.     For  the  32  possible  control  codes  there  are 
some  repeat  permutations  but  no  code  repeats  because  different 
bits  can  be  inverted  for  the  same  permutation.    For  example  in 
Fig.  3  assume  the  following  states  for  each  switch: 

CI  =  1,  C2  =  0,  C3  =  1,  C4  =  0,  C5  «  1,  then: 

input  A  is  switched  to  line  4  and  inverted 

input  B  is  switched  to  line  1  and  not  inverted 
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Input  C  is  switched  to  line  2  and  inverted 

input  D  is  switched  to  line  3  and  not  inverted. 

The  line  drivers  receive  the  permuted  digital  video  signal 
from  the  permuter  and  convert  it  to  a  differential  output  signal. 
This  signal  drives  a  balanced  twisted-pair  transmission  line 
terminated  at  each  extreme  in  the  characteristic  impedance.  The 
advantage  is  that  the- data  is  not  affected  by  common-mode  signals 
induced  on  the  line  thereby  insuring  error-free  transmission  and 
recovery  of  data  over  long  lines. 

During  the  blanking  intervals  of  the  video  signals,  when  the 
synchronization  pulses  occur,  the  output  of  the  drivers  are 
inhibited  to  prevent  an  evader  from  determining  which  bits  are 
inverted,  because  at  that  time  the  value  of  the  video  luminance 
signal  is  zero.     Inhibiting  the  drivers  during  this  interval  also 
allows  the  use  of  one  of  the  video  data  lines  for  transmission 
of  the  synchronization  signal.     Thus  the  transmission  line 
between  the  camera  and  recording  station  consists  of  four  video 
data  lines,  one  of  which  carries  the  synchronization  pulse,  and 
a  fifth  line  for  the  blanking  signal. 

The  command  to  advance  to  a  new  stored  random  word  in  the 
camera  package  must  simultaneously  accompany  a  2  bit  random  code. 
To  avoid  complication  in  the  figure  this  is  not  shown  in  Pig.  1. 
The  purpose  of  the  2  bit  random  code  is  to  prevent  an  evader  from 
falsely  advancing  the  tape  reader  prior  to  a  genuine  command.  If 
this  were  not  done  it  would  allow  an  evader  to  extract  and  record 
the  entire  supply  of  encoded  video  patterns  which  in  turn  could 
be  transmitted  to  the  recording  station  in  sequence  with  the  actual 
commands.     Sending  a  2  bit  code  only  at  the  time  of  update  forces 
any  evasion  attempts  to  operate  in  real  time.     In  practice  the  2 
bit  random  code  is  permuted  with  2  bits  from  the  paper  tape  reader 
and  put  into  a  data  latch  before  they  are  used  as  control  bits  for 
the  permuter.     Pig.  4  shows  the  scheme  used  to  permute  the  2  bit 
random  code.     Two  dpdt  switches  similar  to  those  used  in  the 
permuter  permute  the  2  bit  code  with  2  bits  from  the  tape  reader. 
An  additional  2  bits  from  the  tape  reader  control  the  state  of 
each  switch.     Thus,  the  2  bit  code  becomes  part  of  the  control  code 
for  the  permuter  but  its  identity  is  lost  through  this  subpermutation 
process.     This  leaves  only  a  one  in  four  chance  of  guessing  what 
the  2  bit  code  will  be  before  it  arrives,  or  a  one  chance  in  four 
of  guessing  how  it  is  permuted.     Injecting  a  known  2  bit  code  only 
helps  if  the  bits  from  the  tape  reader  happen  to  be  the  complement 
of  the  known  2  bit  code.     The  probability  of  multiple  successful 
guesses  diminshes  rapidly  with  these  odds. 

The  entire  control  code  for  the  permuter  is  held  in  a  data 
latch  which  temporarily  stores  the  code  which  is  used  until  an 
update  command  is  received.     The  update  command  permits  a  new 
word  from  the  tape  reader  permuted  with  a  new  2  bit  code  to  be 
transferred  through  the  latch  to  the  permuter.  Approximately 
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0.5  ys  after  the  update  command  has  been  received,  the  control  code 
Is  latched  into  storage  and  used  to  determine  the  coding  pattern 
for  the  frame  being  photographed  and  subsequent  frames.  While 
the  control  word  Is  held  In  the  latch  the  tape  reader  advances 
to  a  new  word  so  that  It  can  be  Instantly  used  at  the  next  update 
command.     The  Instantaneous  change  of  the  code  at  the  encoder  and 
decoder  occurs  essentially  simultaneously  so  that  the  position  In 
the  picture  where  the  code  was  changed  Is  Imperceptible.  In 
addition,  the  time  of  code  change  is  unrelated  to  the  sweep 
frequency  of  the  camera,  hence,  the  starting  position  of  a  code 
change  in  the  picture  is  entirely  random.     The  picture  is  photo- 
graphed at  the  time  the  code  is  changed  so  that  there  exists 
practically  no  time  for  an  evader  to  break  the  code  and  re-insert 
false  video  information.    This  is  Important  to  the  security  of  the 
system  because  attempts  to  break  the  code  require  full  bit-by-blt 
storage  of  the  picture  and  accurate  recognition  of  the  time  of  a 
code  change. 

Early  in  the  design  phases  of  this  system  it  was  recognized 
that  permuting  a  natural  binary  or  Gray  code  is  not  entirely 
secure  under  dynamic  conditions  (i,e.  a  changing  input  signal 
for  the  same  encoding  pattern).     This  is  because  the  least 
significant  bit  (LSB)  is  the  busiest,  l,e.  it  has  the  highest  ' 
frequency  content  relative  to  the  other  digits.     In  the  natural 
binary  code  from  numbers  0  to  15  the  LSB  makes  15  transitions 
and  the  MSB  makes  only  one.    The  Gray  code  has  8  transitions  in 
the  LSB  and  one  in  the  MSB.     Thus,  it  is  possible  to  identify 
the  significance  of  the  bits  from  their  relative  frequencies  by 
observing  a  scanning  line  of  a  normal  video  signal.    An  attempt 
was  made  to  develop  a  code  which  roughly  equalizes  the  number 
of  transitions  made  by  the  LSB  and  MSB,     This,  however,  complicated 
the  design  considerably  and  Introduced  more  noise  in  the  system. 
Although  a  type  of  Gray  code  with  equalized  number  of  transitions 
could  be  developed  it  was  decided  that  the  degree  of  extra 
security  offered  by  choosing  a  special  code  did  not  warrant  the 
added  complexity  and  degradation  in  performance.  Furthermore, 
Identification  of  the  significance  of  the  bits  does  not  break 
the  code  because  the  bits  that  are  Inverted  must  also  be 
determined.     This,  coupled  with  the  fact  that  the  system  runs 
asynchronously  (no  clock),  makes  decoding  difficult.    To  effect 
an  evasion  by  substituting  false  video  information  requires 
rapid  identification  of  the  code  pattern  and  reinsertion  of 
a  properly  encoded  false  signal  all  in  an  Interval  which  can 
not  be  detected.     The  resources  required  to  do  this  seem 
formidable  particularly  in  relation  to  the  low  cost  and  sim- 
plicity of  the  encoder/decoder  system  and  more  than  likely 
would  force  evasion  attempts  to  other  areas. 

Pig.  5  is  a  photograph  of  the  entire  video  encoder  which 
is  constructed  on  a  14  x  25  cm  printed  circuit  card.    The  card 
contains  the  circuits  for  the  4  bit  a/d  converter,  permuter, 
2  bit  code  permuter,  data  latch,  and  line  drivers. 
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4.2  Decoder 


The  decoder  consists  of  line  receivers,  de-permuter.  Gray  to 
binary  code  converter,  and  digital  to  analog  converter.    The  line 
receivers  convert  the  balanced  differential  signal  on  the  trans- 
mission line  to  normal  logic  levels.     The  encoded  4-bit  video 
signal  passes  through  a  de-permuter  which  is  actually  a  second 
permuter  of  identical  design  to  the  one  illustrated  in  Pig,  3, 
An  identical  set  of  words  on  punched  tape  plus  the  2  bits  for 
the  random  code  control  the  permuter  the  same  way  as  in  Fig,  4, 
so  that  the  video  signal  is  restored  to  its  originally  generated 
Gray  code.     The  Gray  code  must  be  converted  to  a  natural  binary 
code  before  conversion  to  an  analog  signal.     This  is  simply  done 
by  a  series  of  logic  gates.     The  digital  to  analog  converter 
produces  an  analog  signal  by  summing  weighted  currents  of  each 
binary  digit.     Synchronization  and  blanking  signals  are  summed 
at  this  point  to  provide  a  complete  composite  video  signal 
suitable  for  the  monitor. 

The  results  of  this  tortuous  path  taken  by  the  video  signal 
are  shown  in  Pig.  6  which  is  an  encoded-decoded  picture  of  a  scene 
in  the  laboratory.     The  picture  was  originally  taken  directly  from 
the  monitor  on  a  35  mm  transparency  and  reprocessed  for  reproduction, 
hence,  the  quality  obtained  is  not  representative  of  that  on  the 
16  mm  film.     Pig.  7  is  a  picture  of  the  same  scene  showing  the 
effect  of  a  permuted  video  luminance  signal  as  a  result  of  a 
mismatch  in  the  two  sets  of  code  words  or  the  results  of  an  un- 
successful tamper.     Note  that  the  outlines  for  large  objects  are 
still  clearly  visible  and  only  the  identities  of  small  objects  have 
become  obscured.     Pig,  8  &  9  show  additional  permutation  patterns. 
In  some  cases  the  picture  appears  as  a  partial  negative  with  the 
contouring  effect  of  quantization  greatly  accentuated.  Some 
patterns  do  not  produce  a  very  noticeable  distortion  but  in  all 
cases  they  can  be  recognized  as  an  improperly  encoded  or  decoded 
picture, 

4 , 3    Paper  Tape  Reader 

Punched  paper  tape  is  used  to  store  the  code  words  which 
control  each  permuter.     Commercial  units  were  not  suitable  for 
this  application  because  their  size  and  shape  factor  generally 
were  not  compatible  with  the  space  available  in  the  secure  TV 
camera  container.     Many  of  the  commercial  units  intended  as 
input  mediums  for  digital  computers  have  high  speed  requirements 
which  are  by  no  means  required  in  this  application.    The  speed 
requirements  are  based  on  the  minimum  interval  between  re- 
corded pictures  which  is  rarely  less  than  a  few  seconds, 

A  special  tape  reader  in  the  form  of  a  cassette  was  designed 
for  this  application.    Pig,  10  is  a  photograph  of  the  assembly 
with  the  front  cover  removed  to  show  the  internal  details.  The 
approximate  dimensions  of  the  cylinder  are  21  cm  in  diameter  and 
10  cm  in  length.     The  unit  employs  one  inch  (2,54cra)  standard 
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fanfold  paper  tape  which  eliminates  the  need  for  take  up  reels 
and  the  associated  mechanisms.     A  pair  of  rubber  pinch  rollers 
driven  by  a  small  1  rpm  clock  motor  advance  the  tape  from  the 
supply  compartment  to  the  spent  compartment.    As  the  tape  is 
pulled  through  the  reading  head  station  it  unfolds  one  leaf  at 
a  time  and  folds  up  in  the  lower  compartment.     The  compartments 
have  a  tape  capacity  for  up  to  13  000  8-bit  words. 

Sensing  of  the  holes  at  the  reading  station  is  accomplished 
by  means  of  an  array  of  nine  phototransistors  and  nine  light 
emitting  diodes  as  the  sources  (i.e.  one  set  for  each  hole).  A 
sprocket  hole,  smaller  in  diameter  than  a  data  hole,  exists  for 
each  character.    This  serves  as  an  indexing  hole  which  is  also 
sensed  by  photoelectric  means.     The  command  to  advance  the  tape 
to  the  next  character  starts  the  clock  motor  which  then  stops 
on  the  next  sprocket  hole. 

The  cassette  can  be  removed  from  the  system  and  new  tapes 
loaded  in  a  convenient  working  area.     The  operation  of  the  system 
is  not  affected  by  removal  of  both  tape  readers  since  each 
permuter  interprets  this  as  a  code  of  all  ones.     An  additional 
benefit  to  the  cassette  approach  is  that  the  possibility  of  theft 
or  surreptitious  copying  of  tapes  can  be  eliminated  by  sealing  new 
tapes  in  each  cassette.     Thus,  an  inspector  simply  removes  a 
spent  unit  and  replaces  it  with  a  new  sealed  unit.    The  spent 
unit  would  be  returned  to  some  central  depot  for  reloading. 

Motion  Detector 

The  motion  detector  was  designed  to  provide  for  selectively 
recording  only  the  most  meaningful  pictures  of  an  area  under 
surveillance  in  order  to  reduce  the  necessary  film  storage 
capacity  and  the  burden  of  analysis.     The  premise  to  this  is  that 
activity,  especially  in  preselected  areas,  may  be  of  interest 
and  therefore  should  be  recorded.     The  basic  principle  of  motion 
detection  is  sensing  a  rate  of  change  in  luminance.  Objects 
which  move  generally  cause  a  change  in  the  luminance  of  the  area 
to  or  from  which  they  have  moved.     Of  course  this  assumes  that 
the  reflectance  of  a  moving  object  differs  measureably  from  the 
background  reflectance  of  the  monitored  area.     The  range  of  measure- 
ment must  have  practical  bounds  to  reject  rapid  changes  such  as 
those  caused  by  modulation  of  the  illumination  source  and  very 
slow  changes  which  have  no  significance. 

The  motion  detector  designed  for  this  system  operates  from 
the  analog  video  signal  to  the  TV  monitor.     Preselected  spots  are 
monitored  in  the  TV  camera  field  of  view  and  the  photographic 
camera  is  commanded  to  record  a  picture  when  there  is  motion  at 
any  one  of  these  locations.     Motion  in  these  areas  is  detected 
by  sensing  changes  in  the  video  luminance  levels  which  exceed  a 
predetermined  rate  of  change.     The  system  is  designed  to  provide 
up  to  ten  spots  which  can  be  employed  in  the  following  two  ways: 
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1.  A  single  spot  can  be  positioned  over  a  critical  area 
or  object  to  be  monitored  without  incurring  alarms 
from  areas  which  are  unimportant  or  subject  to  normal 
activity.     This  application  can  be  extended  to  numerous 
spots  which  individually  monitor  many  areas  of  interest 
in  the  scene. 

2.  A  series  of  spots  may  be  located  in  a  horizontal  or 
vertical  line  where  the  passage  of  an  object  across 
the  line  is  significant.    For  example  this  technique 
may  be  applied  to  detect  objects  lifted  by  an  overhead 
crane.     Proper  spacing  between  spots  in  relation  to 
minimum  dimensions  of  the  object  of  Interest  will  allow 
detection  of  those  objects  which  cross  the  monitored  line. 
In  both  applications  it  is  desirable  to  locate  the  spots 
where  normal  activity  does  not  occur.    However,  extran- 
eous pictures  may  be  unavoidable  if  spots  are  positioned 
to  monitor  a  location  in  the  background  which  is  below 
he'ad  height  in  the  foreground  where  normal  activity 
occurs. 

Pig.  11  shows  a  block  diagram  of  the  motion  detector  system 
for  one  of  ten  detectors.     The  heart  of  the  detector  is  a  sample 
and  hold  system  in  which  a  gated  video  luminance  signal  is  compared 
with  a  previously  stored  level  over  some  time  interval.     If  the 
new  value  of  the  gated  signal  differs  from  the  stored  value  by 
a  fixed  threshold,  an  alarm  is  produced  which  commands  the  camera 
to  take  a  picture.     The  motion  alarm  output  signals  of  all  motion 
detectors  are  connected  together  so  that  an  alarm  from  any 
one  will  command  the  camera. 

The  synchronization  (sync)  signal  is  taken  directly  from  the 
decoder  before  it  is  combined  with  the  video  luminance  signal. 
This  obviates  the  need  to  separate  it  again  from  the  composite 
signal.    The  sync  processing  circuit  does  several  things.  First 
the  horizontal  sync  pulses  are  separated  from  the  vertical  sync 
signal.    The  sampling  rate  (i.e.  the  rate  at  which  a  video  sample 
is  taken)  is  generated  by  a  circuit  which  locks  on  to  either  the 
odd  or  even  field  and  produces  pulses  which  occur  at  the  rate  of 
one  per  five  or  one  per  fifty  odd  or  even  fields.     This  results 
in  a  sampling  rate  of  6  Hz  and  0.6  Hz  for  a  30  frames  per  second 
system.     The  purpose  of  having  available  two  sampling  rates  will 
be  explained  later.     Second,  the  horizontal  sync  pulses  of  the 
sampled  field  are  counted  in  an  8  stage  binary  counter.     The  8 
bit  binary  number  representing  the  scanning  line  number  of  one 
field  goes  to  the  spot  positioning  circuit. 

The  spot  positioning  circuit  selects  the  point  on  the  raster, 
vertical  and  horizontal,  where  a  video  sample  is  taken.    The  vertical 
position  is  determined  by  the  state  of  8  switches  arranged  in  a 
binary  sequence.     When  the  state  of  the  counter  matches  the  line 
number  set  by  the  switches,  a  pulse  is  formed.     This  pulse  is 
delayed  by  a  variable  delay  circuit  which  determines  the  horizontal 
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position  of  the  sample.     The  pulse,  about  l/50th  the  length  of  a 
single  scanning  line,  is  gated  at  the  sampling  rate  to  produce  the 
sample  command  for  the  sample-and-hold  circuit.     In  general  the 
smaller  the  sample  the  greater  the  sensitivity  to  motion.  This 
is  because  the  sample  represents  an  area  which  should  be  small  in 
relation  to  the  area  covered  by  a  moving  object  to  realize  the 
greatest  change  in  illumination.     A  marker  pulse  identical  to  the 
sample  pulse  is  also  produced  and  combined  with  the  video  signal 
before  it  goes  to  the  monitor.     This  produces  an  intensified  area 
on  the  monitor  representing  the  size  and  location  of  the  monitored 
spot.     By  observing  the  monitor  the  position  of  the  spot  can  be 
set  over  the  desired  area.     The  pictures  in  Pig.  6,  7»  8,  and  9 
show  eight  spots.     Two  sets  are  located  in  the  doorway  and  two 
sets  are  located  to  the  right  of  the  door.     In  this  arrangement 
a  picture  would  be  recorded  when  someone  walked  through  the 
doorway  or  moved  the  trash  container. 

The  sample  and  hold  circuit  is  essentially  an  electronic  switch 
and  storage  capacitor.     The  sample  command  closes  the  switch  and 
the  capacitor  quickly  attains  the  voltage  value  of  the  sampled  video. 
When  the  switch  is  open  the  capacitor  retains  this  value  over  the 
sampling  interval.    The  output  of  the  sample  and  hold  circuit  goes 
to  a  differentiator  which  is  composed  of  a  single  RC  network.  This 
circuit  responds  only  to  a  change  in  voltage  at  the  sample  time. 
In  other  words  if  a  change  occurs  between  the  time  the  last  sample 
was  taken  and  a  new  sample,  then  the  differentiator  will  respond 
with  an  output.     Conversely  if  there  is  no  change  in  level  from 
sample  to  sample,  then  the  output  of  the  differentiator  will  remain 
at  zero.     The  output  of  the  differentiator  is  followed  by  an  amp- 
lifier to  boost  the  derivative  signal.     The  output  of  the  amplifier 
goes  to  a  bipolar  threshold  detector  which  produces  a  motion  alarm 
signal  if  the  peak  voltage  exceeds  positive  or  negative  threshold 
levels.     The  purpose  of  bipolar  threshold  levels  is  for  detection 
of  luminance  changes  in  either  direction  (i.e.  light  to  dark  and 
dark  to  light ) . 

Pig.  12  is  a  photograph  which  shows  a  card  containing  the 
components  for  one  motion  detector.     The  eight  switches  at  the 
edge  are  for  positioning  the  spot  vertically.     The  two  upper  switches 
are  for  turning  off  the  marker  and  the  motion  alarm  signal.  In 
most  cases  it  is  desirable  to  leave  the  markers  on  to  help  identify 
which  spot  triggered  the  camera.    Turning  off  the  motion  alarm  allows 
a  detector  to  be  disabled  without  pulling  out  the  card.     The  system 
also  permits  any  number  of  cards  from  1  to  10  to  be  used. 

The  sensitivity  is  determined  by  the  gain  of  the  amplifier 
following  the  sample  and  hold  circuit  and  the  threshold  levels. 
In  this  system  the  sensitivity  is,  to  a  large  extent,  limited  by 
the  4  bit  resolution  of  the  luminance  signal.    Increasing  the  motion 
detector  sensitivity  much  beyond  this  Just  increases  the  false 
alarm  rate  due  to  noise  in  the  signal,     A  low-pass  filter  preceding 
the  sample-and-hold  circuit  filters  out  the  high  frequency  components 
of  the  signal  not  essential  for  detection  of  motion  and  reduces  the 
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noise.     In  practice  a  one  part  in  l6  change  in  illumination  seems 
to  be  quite  adequate  for  motion  detection. 

Increasing  the  sampling  interval  enhances  the  sensitivity  to 
slowly  moving  objects  such  as  large  cranes  which  lift  a  load  very 
slowly.     A  faster  sampling  rate  is  more  desirable  for  monitoring 
the  ordinary  movements  of  people  or  faster  moving  machinery.  One 
sampling  rate  does  not  extend  the  sensitivity  over  the  wide  range 
of  possible  rates  of  movement.     For  instance  a  detector  using  a 
slow  sampling  rate  would  not  necessarily  detect  a  person  walking 
rapidly  through  the  monitored  area.     For  this  reason  two  sampling 
rates  were  made  available  so  that  a  motion  detector  can  be  pro- 
grammed for  a  fast  (6  Hz)  or  a  slow  (0,6  Hz)  sampling  rate.  If 
an  application  requires  detection  of  both  slow  and  fast  movements 
in  the  same  location,  two  motion  detectors,  one  programmed  for 
slow  and  one  for  fast  can  be  used  as  in  Figure  6, 

A  second  important  function  of  the  motion  detectors  is  pro- 
tection of  the  system  against  deception  from  insertion  of  false 
scenes  in  the  TV  camera's  field  of  view,  movement  of  the  camera 
from  its  mounting,  and  substitution  of  video  data  on  the  trans- 
mission line.     The  detection  of  these  possibilities  manifests 
itself  in  a  recorded  picture  which  shows  evidence  of  tampering.' 
Insertion  of  video  signals  from  another  source  without  the  correct 
code  will  produce  scrambled  gray  levels  which  will  be  sensed  by 
the  motion  detectors  causing  a  picture  to  be  recorded.     In  the 
case  of  attempted  camera  movement  the  result  may  be  a  recorded 
picture  that  is  mlsregistered  in  comparison  to  the  other  previous 
frames.    Experience  has  shown  that  very  slight  frame  misalignment 
of  a  single  picture  can  be  detected  while  playing  back  the  film. 
The  speed  of  response  of  the  motion  detector  is  such  that  attempts 
at  scene  substitution  appear  difficult.     A  sampling  rate  of  6  Hz 
forces  an  evader  to  mechanically  position  a  false  scene  and 
associated  optics  in  perfect  registration  in  a  period  of  less 
than  167  milliseconds.     In  addition,  the  approximately  correct 
illumination  must  be  provided.    While  such  attempts  are  probably 
difficult  to  implement  an  evader  can  take  advantage  of  a  lock- 
out interval  when  no  picture  can  be  recorded.    For  practical 
reasons  some  lock-out  interval  is  required  to  limit  the  number 
of  frames  when  there  is  a  great  deal  of  motion. 

The  design  provides  for  a  lock-out  period  of  approximately 
2  minutes.     This  interval  is  generated  by  a  separate  clock  which 
provides  a  reset  once  every  2  minutes  regardless  of  the  state  of 
the  motion  detector  output.     In  other  words,  the  reset  time  is 
not  related  to  a    motion  alarm.     Thus,  after  one  alarm  the  motion 
detector  output  might  be  enabled  any  time  after  that  up  to  two 
minutes.     The  uncertainty  of  the  time  when  this  reset  may  occur 
coupled  with  the  uncertainty  of  a  command  from  the  random  interval 
timer  makes  evasion  attempts  risky.    Although  there  are  ways  of 
determining  the  reset  time,  there  are  ways  of  increasing  the 
sophistication  of  the  lock-out  logic.    For  instance  if  there  is 
a  simultaneous  alarm  from  all  the  motion  detectors  this  might 
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Pig.  13    TV  camera  assembly  In  the  NBS  Reactor  fuel  storage  room, 
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override  the  lock-out  because  this  is  an  unusual  situation. 
Randomizing  the  lock-out  interval  is  another  approach.  None 
of  these  techniques  were  implemented  in  this  design  mainly 
because  the  purpose  was  to  evaluate  the  effectiveness  of  the 
motion  detectors  in  a  field  environment. 

5.     FIELD  TESTS 

Before  testing  the  system  at  the  NPD  reactor  in  Canada  it 
was  installed  in  the  NBS  reactor  fuel  storage  room.     This  area 
provided  an  opportunity  to  make  tests  in  an  environment  similar 
to  the  NPD  fuel  storage  room.     Pig,  13  is  a  photograph  in  this 
setting  of  the  TV  camera  assembly  which  is  mounted  on  a  steel 
pedestal.     The  silvered  plastic  cylinder  houses  the  TV  camera, 
encoder,  tape  reader  and  power  supplies.     The  cylinder  (23  cm 
diameter,  50  cm  length)  is  supported  in  an  aluminum  cradle  which 
has  an  adjustable  strut  underneath  to  permit  adjustments  of  the 
viewing  angle. 

Pig,  14  is  a  photograph  of  the  equipment  that  would  be 
located  in  the  recording  station.     The  monitor  is  shown  with 
a  mirror  removed  to  provide  access  to  the  screen  and  controls. 
When  the  mirror  is  in  place  the  image  path  from  the  screen  to 
the  camera  lens  is  folded  to  provide  a  compact  arrangement. 
The  16  mm  camera  and  single  frame  advance  mechanism  are  mounted 
behind  the  mirror  box.     The  bottom  portion  of  the  figure  shows 
the  chassis  and  controls  for  ten  motion  detectors,  video  decoder, 
tape  reader,  and  power  supplies. 

During  the  week  of  June  11,  1972,  the  system  was  Installed 
in  the  fuel  storage  room  of  the  NPD  reactor  near  Rolphton, 
Ontario,  Canada,     The  main  area  in  the  room  consists  of  a  deep 
pool  of  water  where  all  the  spent  fuel  bundles  are  stored  and 
allowed  to  cool  off.     The  basic  purpose  in  applying  surveillance 
to  this  area  is  to  ascertain  that  no  unaccounted-for  spent  fuel 
bundles  or  parts  thereof  are  removed  from  the  bay.     The  normal 
removal  method  utilizes  a  large  shielded  cask  which  is  lifted 
by  an  overhead  crane.    There  are,  however,  various  other 
unconventional  means  of  removing  fuel  from  the  bay.     The  various 
illicit  means  for  removing  fuel  bundles  from  the  bay  have  not 
been  clearly  defined  although  it  appears  that  bundles  can  be 
lifted  directly  wl^hov't  shielding. 

All  ten  motion  detectors  were  used  for  this  test,     A  group 
of  spots  were  arranged  in  a  line  overhead  to  detect  objects 
lifted  by  the  overhead  crane.     The  remaining  spots  were  positioned 
in  various  areas  where  normal  activity  may  occur  for  the  purpose 
of  exercising  the  sys+-em.    The  random  interval  time  and  clock 
time  were  obtained  from  the  previously  Installed  TRUST  instru- 
mentation system.    The  random  interval  timer  had  a  mean  time  of 
20  minutes. 

Operation  over  approximately  a  six  month  interval  revealed 
the  following  problems: 
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Operation  over  approximately  a  six  month  interval  revealed 
the  following  problems: 

1.  The  tape  readers  tended  to  get  out  of  synchronization, 
causing  scrambled  pictures. 

2.  The  video  output  from  the  TV  camera  occasionally  dropped 
out,  requiring  readjustment. 

3.  Several  of  the  power  supplies  in  the  system  failed. 

The  control  circuitry  for  advancing  the  tape  reader  was  redesigned 
to  make  it  less  susceptible  to  interference  and  momentary  power 
outages.     The  difficulty  with  the  TV  camera  has  yet  to  be  resolved. 
It  was  discovered  that  the  video  often  would  not  recover  after 
momentary  power  outages  which  occurred  rather  frequently.  To 
overcome  the  frequent  power  interruptions  the  system  was  put  on 
the  TRUST  instrumentation  power  supply  system  which  consists  of  a 
28  volt  battery  that  is  charge-maintained  by  the  120V,  60Hz  power. 
Since  the  TV  system  was  designed  for  120V,  60Hz,  a  28  volt  dc  to 
120  volt  ac  inverter  had  to  be  employed. 

The  failure  of  several  power  supplies  was  attributed  to  heat. 
All  power  supplies  in  the  system  of  the  potted  design  eventually 
failed.     Apparently  these  commercial  supplies  cannot  operate  in 
ambient  temperatures  of  45  to  50°C  which  is  well  within  their 
advertised  specifications.     Different  power  supplies  of  the 
unpotted  variety  are  being  considered  for  replacements. 

An  additional  problem  which  developed  during  the  period 
was  noise  on  the  video  signal.     It  manifested  itself  in  the  form 
of  occasional  white  bars  of  about  1  ys  in  duration.    When  a  noise 
pulse  occurred  in  the  same  location  as  a  motion  spot  a  false 
alarm  was  produced.     The  noise  did  not  appear  to  be  of  periodic 
nature  and  the  severity  varied  from  time  to  time.    Even  though 
the  system  was  operated  on  the  battery  power  supply  the  noise 
persisted  and  was  observable  directly  at  the  TV  camera  video 
output.     The  source  was  attributed  to  two  possibilities;  the 
camera  itself,  or  a  noisy  machine  in  the  facility. 

The  first  roll  of  film  was  developed  and  analyzed  on  the 
special  stop-motion  projector.     The  motion  detectors  performed 
well  by  capturing  a  number  of  interesting  sequences  involving 
unusual  fuel  handling  operations.     During  periods  of  no  activity 
in  the  area  the  number  of  pictures  recorded  was  essentially 
limited  by  the  random  interval  timer  indicating  that  the  false 
alarm  rate  of  the  motion  detectors  was  very  low.     One  thing  that 
has  become  apparent  from  reviewing  the  pictures  is  that  it  is 
desirable  to  shorten  the  motion  lock-out  period.     Often  there 
are  sequences  where  motion  in  an  area  triggered  only  one  picture. 
This  is  often  insufficient  information  to  determine  the  type  of 
activity  taking  place.     Shortening  the  interval  produces  more 
pictures  but  also  consumes  more  frames.     A  more  sophisticated 
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type  of  lock-out  logic  which  provides  for  more  pictures  of  a 
sequence  and  economical  use  of  frames  could  be  designed. 

Experience  has  also  confirmed  that  the  need  for  more  than 
ten  spots  is  the  exception  rather  than  the  rule.  Situations 
requiring  more  than  10  spots  might  occur  when  applications 
require  many  spots  to  be  used  as  containment  perimeters  around 
certain  objects. 

6.  CONCLUSIONS 

A  tamper-resistant  television  surveillance  system  has  been 
developed.     The  system  utilizes  commercial  closed  circuit  TV 
and  photography  coupled  with  a  video  encoding  technique  for 
security,  and  motion  detectors  for  selective  recording  of  pic- 
tures.    The  incorporation  of  these  additional  features  adds 
little  comparative  complexity  to  ordinary  closed  circuit  TV 
while  greatly  increasing  its  effectiveness  as  a  surveillance 
tool  for  safeguards  applications.     Specific  technical  con- 
clusions based  on  the  work  are  listed  below: 

1,     Video  signals  quantized  in  four  bit  Gray  code  and 
decoded  produce  negligible  distortion  of  pictures, 

r   2,     Permuting  and  inverting  some  of  the  bits  of  video 

luminance  signal  before  transmitting  is  an  effective 
technique  of  preventing  substitution  of  false  data. 

3.     A  2  bit  code  must  be  transmitted  to  the  camera  package 
at  the  time  of  code  update  to  maintain  security. 

^.  The  motion  detectors  enable  a  considerable  saving  of 
recording  capacity  by  selectively  recording  pictures 
when  motion  occurs  in  preselected  areas. 

5.  A  slow  and  a  fast  sampling  rate  is  required  to 
adequately  detect  the  possible  speeds  of  motion, 

6.  The  motion  detectors  help  to  protect  the  system 
against  deception  from  insertion  of  false  scenes 
in  the  camera* s  field  of  view. 

7.  Observing  the  film  through  a  special  stop-motion 
projector  appears  to  be  a  relatively  fast  and 
accurate  method  of  analyzing  the  data. 

The  problems  revealed  during  the  field  tests  do  not  appear 
fundamental  in  nature  and  can  be  corrected  by  improved  design. 
The  field  test  has  made  it  clear  that  the  motion  lock  out  period 
needs  to  be  shortened  and  optimized  for  the  application.    A  more 
sophisticated  lock-out  logic  which  considers  more  factors  in  the 
determination  of  the  lock-out  period  could  be  designed.  This 
would  tend  to  optimize  the  amount  of  useful  information  stored 
for  a  given  storage  capacity. 
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One  thing,  which  was  not  fully  appreciated  before,  is  now 
apparent.     The  accumulation  of  field  experience  and  information 
regarding  the  effectiveness  of  the  system  will  require  a  great 
deal  of  time.     Any  system  of  this  nature,  although  it  may  prevent 
diversions,  is  potentially  vulnerable  to  harassment.    This  point 
was  made  more  evident  from  some  of  the  failures  encountered, 
particularly  the  synchronization  problems  with  the  tape  readers 
which  can  cause  all  the  pictures  to  be  scrambled.     Although  this 
problem  was  corrected  it  still  may  be  a  weakness  from  the  stand- 
point of  harassment  and  therefore  require  a  more  thorough  re- 
design.    The  reason  for  the  guarded  optimism  is  that  still  too 
little  is  known  of  how  this  system  might  perform  under  a  real 
life  situation.     If  the  system  can  be  made  to  fail  without 
indicating  that  it  has  been  intentionally  defeated  then  it  will 
be  of  little  value.     The  many  possible  unthought-of  diversions 
and  harassment  techniques  can  only  be  uncovered  by  more  tests 
and  experience  especially  by  groups  not  involved  in  the  original 
design.     Furthermore,  because  this  system  involves  technology  at 
one  point  in  the  state  of  the  art,  future  advancements  in  technology 
may  seriously  endanger  the  effectiveness  of  the  system.  Hence, 
the  system  must  be  continuously  evaluated  with  respect  to  the 
state  of  technology  and  the  overall  objective  which  is  to  provide 
early  detection  of  the  diversion  of  nuclear  material  to  other 
than  peaceful  purposes. 
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